Make integration

App modules and the HTTP module

Built-in app modules handle authentication and common actions for many services. When an app has no module, or the module lacks an action you need, the HTTP module can call the app's API using its documentation. This reaches anything the API offers but needs more care with authentication, data formats and errors.

Integration patterns

Custom webhooks

A custom webhook gives an app a URL to send data to. Because anyone who knows the URL can call it, verify requests where the sending app signs them, as Stripe's and GitHub's webhook guidance describes, and check incoming data before acting on it. Respond promptly so the sender does not retry unnecessarily.

Authentication

APIs use keys, OAuth or other schemes. Store credentials in Make's connections rather than typing them into module fields, use business-owned accounts and request only the access needed. OAuth tokens can expire, so watch for authentication errors.

Building a Make integration

1. 01

   Field map

   Fields, formats, source of truth.

   Output: Mapping table

2. 02

   Choose pattern

   Webhook, polling or batch.

   Output: Integration design

3. 03

   Connect

   Modules or HTTP, credentials.

   Output: Working connection

4. 04

   Harden

   Verification, paging, duplicates.

   Output: Resilient scenario

5. 05

   Test and monitor

   Edge cases, alerts.

   Output: Live integration

Example: connecting a niche booking system

Make integration checks

Paging and rate limits

APIs return large result sets in pages and limit request rates. Loop through pages so no records are missed, add pauses or batching where limits are tight and handle 'too many requests' errors with retries after a delay.

Avoiding duplicates

Look up existing records before creating new ones, using a stable reference such as an email address or order number. Where the target API offers idempotency keys, as Stripe's does, use them so retried requests do not repeat actions.

Field mapping

Write down each field, its source and destination, any transformation and what happens if it is missing. Decide which system is the source of truth for each field to avoid conflicts. Agree how deletions are handled, since they are easy to forget.

Operation cost

Make counts each module run per bundle as an operation. Integrations processing many records, or polling often, use more. Filter early and choose schedules sensibly.

Errors and monitoring

Attach error handlers to modules that call external APIs, decide whether to retry, skip or stop, and send alerts with the record details. Check run history for recurring failures, and periodically compare record counts between systems to catch anything missed. An integration that fails silently can leave systems out of step for weeks before anyone notices.

Treat incoming data as untrusted

Data arriving from other systems or webhooks may be malformed or unexpected. Validate it before using it, avoid logging sensitive fields and keep credentials scoped to what each scenario needs. The OWASP API Security Top 10 lists common weaknesses worth checking.